Threat database

CVE-2026-86489 is an Insecure Direct Object Reference (IDOR) vulnerability in JetBrains YouTrack versions before 2026.2.18634. It affects the user profile API, allowing unauthorized disclosure of private issues and starred folders across organizations. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No known exploits are reported in the wild. JetBrains has not provided explicit patch information in the input data.

CVE-2026-86488 is an Insecure Direct Object Reference (iDOR) vulnerability in JetBrains YouTrack versions before 2026.2.18634. It allows unauthorized access to private saved searches via the watchRules and issueListConfig endpoints. The vulnerability has a medium severity with a CVSS score of 6.5, indicating a network attack vector with low complexity and no user interaction required. Confidentiality impact is high, but integrity and availability are not affected.

CVE-2026-86487 is a low-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It allows users with read-only whiteboard permissions to modify canvas content by sending a crafted WebSocket message. This issue is classified under CWE-863 (Incorrect Authorization). No confidentiality or availability impact is reported.

CVE-2026-86486 is a low-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. The issue involves the generic VCS webhook handler failing open when its secret is blank, which may lead to limited integrity impact. No confidentiality or availability impacts are reported.

CVE-2026-86485 is a vulnerability in JetBrains YouTrack before version 2026.2.18634 that allows IP spoofing via HTTP headers, enabling forged Bitbucket webhooks. The issue is classified under CWE-291 (Improper Authentication). The CVSS score is 3.5 (low severity), indicating limited impact primarily on confidentiality. No known exploits are reported in the wild. The vulnerability requires user interaction and local access vector with low attack complexity and no privileges required.

CVE-2026-86484 is a medium severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It involves an AngularJS template injection in assignee names that leads to stored cross-site scripting (XSS). This vulnerability allows an attacker with limited privileges to inject malicious scripts that are stored and executed in the context of other users. The vulnerability has a CVSS 3.1 base score of 4.6, indicating a moderate impact on confidentiality and integrity with no impact on availability. No official patch or vendor advisory details are provided in the input data.

CVE-2026-86483 is a stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions before 2026.2.18634. The issue arises from a custom field on Agile board cards that allows malicious scripts to be stored and executed. This vulnerability has a medium severity rating with a CVSS score of 5.4. It requires low privileges and user interaction to exploit and can lead to partial confidentiality and integrity impacts without affecting availability.

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

CVE-2026-86481 is a medium severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It involves signed URL reuse that allows unauthorized disclosure of restricted project icons. The vulnerability is related to CWE-639, which concerns authorization bypass through URL manipulation. No known exploits are reported in the wild. The vulnerability affects versions from initial releases up to but not including 2026.2.18634.

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR